Adam Moussa 2f2fc83a82 fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin ... GPT-4.1 cross-family review of the policy surface (no BLOCK): FIX applied to the cross-account shoc-backend-dev Decrypt statement and both Lambda role KMS grants (the key is only ever used via Secrets Manager); its invariant-enforcement QUESTION answered durably with tests/test_cross_account_principal_pin.py (any new foreign IAM principal in cdk/ fails CI). Scanner mediums fixed: delivery.py and the replay script now refuse non-https URLs (urllib follows file:// and http://). SQS metadata-action and dynamodb:ListStreams NITs skipped: standard CDK grant shapes; ListStreams has no resource-level scoping. The 4 gitleaks HIGHs on docs/shoc-webhook-test-vectors.json are deliberate non-secrets (shared receiver-verification vectors) suppressed machine-level with justification.		2026-07-24 15:00:15 -04:00
..
app.py	feat(api): procurement-api read stack + OpenAPI docs (SHOC reconciliation path) (#127)	2026-07-23 19:32:20 -04:00
cdk.json	Initial commit: PO email ingestion pipeline	2026-04-07 12:12:30 -04:00
common.py	fix(cdk): explicit Lambda LogGroups replace log_retention (INFRA-114) (#126)	2026-07-23 17:21:07 -04:00
po_stack.py	fix(cdk): explicit Lambda LogGroups replace log_retention (INFRA-114) (#126)	2026-07-23 17:21:07 -04:00
procurement_api_stack.py	feat(api): Redocly lint gate + SHOC-themed /docs (Redoc theming, topbar, collapsible samples) (#130)	2026-07-24 18:04:30 +00:00
requirements.txt	chore(deps): bump boto3 to 1.43.51 (po/web_ui, po/site_extractor, wo/web_ui) and constructs to 10.7.1 (cdk) (#121)	2026-07-20 17:22:15 -04:00
wo_stack.py	fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin	2026-07-24 15:00:15 -04:00